edumfa 2.7.2__tar.gz → 2.8.0__tar.gz

{edumfa-2.7.2/edumfa.egg-info → edumfa-2.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: edumfa
-Version: 2.7.2
+Version: 2.8.0
 Summary: eduMFA: identity, multifactor authentication (OTP), authorization, audit
 Author-email: "edumfa.io" <edumfa@listserv.dfn.de>
 License:                     GNU AFFERO GENERAL PUBLIC LICENSE
@@ -647,44 +647,44 @@ Requires-Python: >=3.9
 Description-Content-Type: text/x-rst
 License-File: LICENSE
 License-File: AUTHORS.md
-Requires-Dist: alembic==1.15.1
+Requires-Dist: alembic==1.15.2
 Requires-Dist: argon2-cffi==23.1.0
 Requires-Dist: argon2-cffi-bindings==21.2.0
 Requires-Dist: async-timeout==5.0.1
 Requires-Dist: babel==2.17.0
 Requires-Dist: bcrypt==4.3.0
-Requires-Dist: beautifulsoup4==4.13.3
+Requires-Dist: beautifulsoup4==4.13.4
 Requires-Dist: blinker==1.9.0
 Requires-Dist: cachetools==5.5.2
 Requires-Dist: cbor2==5.6.5
-Requires-Dist: certifi==2025.1.31
+Requires-Dist: certifi==2025.4.26
 Requires-Dist: cffi==1.17.1
-Requires-Dist: charset-normalizer==3.4.1
+Requires-Dist: charset-normalizer==3.4.2
 Requires-Dist: click==8.1.8
 Requires-Dist: configobj==5.0.9
 Requires-Dist: croniter==6.0.0
-Requires-Dist: cryptography==44.0.2
+Requires-Dist: cryptography==44.0.3
 Requires-Dist: crypt-r==3.13.1; python_version == "3.13" and sys_platform == "linux"
 Requires-Dist: defusedxml==0.7.1
 Requires-Dist: flask==3.1.0
 Requires-Dist: flask-babel==4.0.0
 Requires-Dist: flask-migrate==4.1.0
 Requires-Dist: flask-sqlalchemy==3.1.1
-Requires-Dist: google-auth==2.38.0
+Requires-Dist: google-auth==2.40.1
 Requires-Dist: grpcio==1.71.0
 Requires-Dist: huey==2.5.3
 Requires-Dist: idna==3.10
-Requires-Dist: importlib-metadata==8.6.1
+Requires-Dist: importlib-metadata==8.7.0
 Requires-Dist: itsdangerous==2.2.0
 Requires-Dist: jinja2==3.1.6
 Requires-Dist: ldap3==2.9.1
-Requires-Dist: lxml==5.3.1
-Requires-Dist: mako==1.3.9
+Requires-Dist: lxml==5.4.0
+Requires-Dist: mako==1.3.10
 Requires-Dist: markupsafe==3.0.2
 Requires-Dist: netaddr==1.3.0
 Requires-Dist: passlib==1.7.4
 Requires-Dist: pyasn1==0.6.1
-Requires-Dist: pyasn1-modules==0.4.1
+Requires-Dist: pyasn1-modules==0.4.2
 Requires-Dist: pycparser==2.22
 Requires-Dist: pydash==8.0.5
 Requires-Dist: pyjwt==2.10.1
@@ -695,24 +695,24 @@ Requires-Dist: python-dateutil==2.9.0.post0
 Requires-Dist: python-gnupg==0.5.4
 Requires-Dist: pytz==2025.2
 Requires-Dist: pyyaml==6.0.2
-Requires-Dist: redis==5.2.1
+Requires-Dist: redis==6.0.0
 Requires-Dist: requests==2.32.3
-Requires-Dist: rsa==4.9
+Requires-Dist: rsa==4.9.1
 Requires-Dist: segno==1.6.6
 Requires-Dist: six==1.17.0
 Requires-Dist: smpplib==2.2.4
-Requires-Dist: soupsieve==2.6
-Requires-Dist: sqlalchemy==2.0.39
-Requires-Dist: typing-extensions==4.13.0
-Requires-Dist: urllib3==2.3.0
+Requires-Dist: soupsieve==2.7
+Requires-Dist: sqlalchemy==2.0.40
+Requires-Dist: typing-extensions==4.13.2
+Requires-Dist: urllib3==2.4.0
 Requires-Dist: werkzeug==3.1.3
 Requires-Dist: zipp==3.21.0
-Requires-Dist: setuptools==78.1.0
+Requires-Dist: setuptools==80.3.1
 Provides-Extra: docs
 Requires-Dist: furo==2024.8.6; extra == "docs"
 Requires-Dist: docutils==0.21.2; extra == "docs"
 Requires-Dist: imagesize==1.4.1; extra == "docs"
-Requires-Dist: packaging==24.2; extra == "docs"
+Requires-Dist: packaging==25.0; extra == "docs"
 Requires-Dist: pyenchant==3.2.2; extra == "docs"
 Requires-Dist: Pygments==2.19.1; extra == "docs"
 Requires-Dist: snowballstemmer==2.2.0; extra == "docs"
@@ -729,19 +729,19 @@ Requires-Dist: sphinx-copybutton==0.5.2; extra == "docs"
 Requires-Dist: sphinx-inline-tabs==2023.4.21; extra == "docs"
 Provides-Extra: test
 Requires-Dist: attrs==25.3.0; extra == "test"
-Requires-Dist: coverage==7.7.1; extra == "test"
+Requires-Dist: coverage==7.8.0; extra == "test"
 Requires-Dist: exceptiongroup==1.2.2; extra == "test"
 Requires-Dist: iniconfig==2.1.0; extra == "test"
 Requires-Dist: mock==5.2.0; extra == "test"
-Requires-Dist: packaging==24.2; extra == "test"
+Requires-Dist: packaging==25.0; extra == "test"
 Requires-Dist: pluggy==1.5.0; extra == "test"
 Requires-Dist: pyparsing==3.2.3; extra == "test"
 Requires-Dist: pytest==8.3.5; extra == "test"
-Requires-Dist: pytest-cov==6.0.0; extra == "test"
+Requires-Dist: pytest-cov==6.1.1; extra == "test"
 Requires-Dist: responses==0.25.7; extra == "test"
 Requires-Dist: testfixtures==8.3.0; extra == "test"
 Requires-Dist: tomli==2.2.1; extra == "test"
-Requires-Dist: types-PyYAML==6.0.12.20250326; extra == "test"
+Requires-Dist: types-PyYAML==6.0.12.20250402; extra == "test"
 Provides-Extra: postgres
 Requires-Dist: psycopg2==2.9.10; extra == "postgres"
 Provides-Extra: hsm

{edumfa-2.7.2 → edumfa-2.8.0}/deploy/ubuntu/changelog

@@ -1,3 +1,40 @@
+edumfa (2.8.0{{CODENAME}}) {{CODENAME}}; urgency=medium
+
+* chore: Drop support for ubuntu focal by @Luc1412 in https://github.com/eduMFA/eduMFA/pull/613
+* ci: allow manual trigger for docker ci action by @fritterhoff in https://github.com/eduMFA/eduMFA/pull/608
+* feat: add hybrid transport for webauthn by @fritterhoff in https://github.com/eduMFA/eduMFA/pull/599
+* feat: decrease log level for crypto usage by @fritterhoff in https://github.com/eduMFA/eduMFA/pull/603
+* feat: disable timeshift by @j-hoff in https://github.com/eduMFA/eduMFA/pull/465
+* feat: handle hmac-extension by @fritterhoff in https://github.com/eduMFA/eduMFA/pull/602
+* feat: improve policy logging by @fritterhoff in https://github.com/eduMFA/eduMFA/pull/604
+* feat: reduce/optimize audit logging by @fritterhoff in https://github.com/eduMFA/eduMFA/pull/590
+* feat: rename property (`EDUMFA_REDUCE_SQLAUDIT`)  by @fritterhoff in https://github.com/eduMFA/eduMFA/pull/594
+* feat: start adding audience check by @fritterhoff in https://github.com/eduMFA/eduMFA/pull/511
+* chore(deps): update dependency alembic to v1.15.2 - autoclosed by @renovate in https://github.com/eduMFA/eduMFA/pull/586
+* chore(deps): update dependency beautifulsoup4 to v4.13.4 by @renovate in https://github.com/eduMFA/eduMFA/pull/605
+* chore(deps): update dependency certifi to v2025.4.26 by @renovate in https://github.com/eduMFA/eduMFA/pull/618
+* chore(deps): update dependency charset-normalizer to v3.4.2 by @renovate in https://github.com/eduMFA/eduMFA/pull/625
+* chore(deps): update dependency cryptography to v44.0.3 by @renovate in https://github.com/eduMFA/eduMFA/pull/626
+* chore(deps): update dependency google-auth to v2.40.1 by @renovate in https://github.com/eduMFA/eduMFA/pull/629
+* chore(deps): update dependency importlib-metadata to v8.7.0 by @renovate in https://github.com/eduMFA/eduMFA/pull/619
+* chore(deps): update dependency lxml to v5.4.0 by @renovate in https://github.com/eduMFA/eduMFA/pull/614
+* chore(deps): update dependency mako to v1.3.10 by @renovate in https://github.com/eduMFA/eduMFA/pull/596
+* chore(deps): update dependency pyasn1-modules to v0.4.2 by @renovate in https://github.com/eduMFA/eduMFA/pull/585
+* chore(deps): update dependency redis to v6 by @renovate in https://github.com/eduMFA/eduMFA/pull/624
+* chore(deps): update dependency rsa to v4.9.1 by @renovate in https://github.com/eduMFA/eduMFA/pull/606
+* chore(deps): update dependency setuptools to v80.3.1 by @renovate in https://github.com/eduMFA/eduMFA/pull/627
+* chore(deps): update dependency soupsieve to v2.7 by @renovate in https://github.com/eduMFA/eduMFA/pull/612
+* chore(deps): update dependency sqlalchemy to v2.0.40 by @renovate in https://github.com/eduMFA/eduMFA/pull/584
+* chore(deps): update dependency typing-extensions to v4.13.2 by @renovate in https://github.com/eduMFA/eduMFA/pull/597
+* chore(deps): update dependency urllib3 to v2.4.0 by @renovate in https://github.com/eduMFA/eduMFA/pull/598
+* fix(deps): pin dependencies by @renovate in https://github.com/eduMFA/eduMFA/pull/601
+* fix(deps): update dependency coverage to v7.8.0 by @renovate in https://github.com/eduMFA/eduMFA/pull/587
+* fix(deps): update dependency packaging to v25 by @renovate in https://github.com/eduMFA/eduMFA/pull/609
+* fix(deps): update dependency pytest-cov to v6.1.1 by @renovate in https://github.com/eduMFA/eduMFA/pull/592
+* fix(deps): update dependency types-pyyaml to v6.0.12.20250402 by @renovate in https://github.com/eduMFA/eduMFA/pull/589
+
+ -- eduMFA <edumfa-dev@listserv.dfn.de>  Wed, 07 May 2025 14:00:00 +0200
+
 edumfa (2.7.2{{CODENAME}}) {{CODENAME}}; urgency=medium
 
 * chore: fix read the docs spec by @fritterhoff in https://github.com/eduMFA/eduMFA/pull/581

{edumfa-2.7.2 → edumfa-2.8.0}/deploy/ubuntu-server/changelog

@@ -1,3 +1,9 @@
+edumfa-server (2.8.0{{CODENAME}}) {{CODENAME}}; urgency=medium
+ 
+  * update version number
+
+ -- eduMFA <edumfa-dev@listserv.dfn.de>  Wed, 07 May 2025 14:00:00 +0200
+
 edumfa-server (2.7.2{{CODENAME}}) {{CODENAME}}; urgency=medium
  
   * update version number

{edumfa-2.7.2 → edumfa-2.8.0}/edumfa/api/lib/postpolicy.py

@@ -907,7 +907,9 @@ def check_verify_enrollment(request, response):
                 tokenobj.token.rollout_state = ROLLOUTSTATE.VERIFYPENDING
                 tokenobj.token.save()
                 response.set_data(json.dumps(content))
+    elif len(tokenobj_list) == 0:
+        log.warning("Token serial {0!s} not found in database.".format(serial))
     else:
-        log.warning("No distinct token object found in enrollment response!")
+        log.warning("No distinct token object found in enrollment response for serial {0!s}!".format(serial))
 
     return response

{edumfa-2.7.2 → edumfa-2.8.0}/edumfa/api/lib/utils.py

@@ -365,16 +365,35 @@ def verify_auth_token(auth_token, required_role=None):
         for trusted_jwt in trusted_jwts:
             try:
                 if trusted_jwt.get("algorithm") in TRUSTED_JWT_ALGOS:
-                    j = jwt.decode(auth_token,
-                                   trusted_jwt.get("public_key"),
-                                   algorithms=[trusted_jwt.get("algorithm")])
-                    if dict((k, j.get(k)) for k in ("role", "resolver", "realm")) == \
+                    if "aud" in trusted_jwt:
+                        # The audience must match
+                        j = jwt.decode(auth_token,
+                                       trusted_jwt.get("public_key"),
+                                       algorithms=[trusted_jwt.get("algorithm")],
+                                       audience=trusted_jwt.get("aud"))
+                    else: 
+                        j = jwt.decode(auth_token,
+                                    trusted_jwt.get("public_key"),
+                                    algorithms=[trusted_jwt.get("algorithm")])
+                    
+                    if "claim" in trusted_jwt and trusted_jwt.get("claim") in j:
+                        j["username"] = j[trusted_jwt.get("claim")]
+                    
+                    log.debug("JWT decoded: {0!s}".format(j))
+                    if re.match(trusted_jwt.get("username") + "$", j.get("username")):
+                        if "static_data" in trusted_jwt:
+                            j["role"] = trusted_jwt.get("role")
+                            j["realm"] = trusted_jwt.get("realm")
+                            j["resolver"] = trusted_jwt.get("resolver")
+                            r = j
+                            log.debug("JWT is trusted. {0!s}".format(r))
+                        elif dict((k, j.get(k)) for k in ("role", "resolver", "realm")) == \
                             dict((k, trusted_jwt.get(k)) for k in ("role", "resolver", "realm")):
-                        if re.match(trusted_jwt.get("username") + "$", j.get("username")):
                             r = j
-                            break
-                        else:
-                            r = wrong_username = j.get("username")
+                            log.debug("JWT is trusted. {0!s}".format(r))
+                        break
+                    else:
+                        wrong_username = j.get("username")
                 else:
                     log.warning("Unsupported JWT algorithm in EDUMFA_TRUSTED_JWT.")
             except jwt.DecodeError as _e:
@@ -384,7 +403,7 @@ def verify_auth_token(auth_token, required_role=None):
                 raise AuthError(_("Authentication failure. Your token has expired: {0!s}").format(err),
                                 id=ERROR.AUTHENTICATE_TOKEN_EXPIRED)
 
-    if not r:
+    if not wrong_username and not r:
         try:
             r = jwt.decode(auth_token, current_app.secret_key, algorithms=['HS256'])
         except jwt.DecodeError as err:
@@ -393,7 +412,7 @@ def verify_auth_token(auth_token, required_role=None):
         except jwt.ExpiredSignatureError as err:
             raise AuthError(_("Authentication failure. Your token has expired: {0!s}").format(err),
                             id=ERROR.AUTHENTICATE_TOKEN_EXPIRED)
-    if wrong_username:
+    if wrong_username and not r:
         raise AuthError(_("Authentication failure. The username {0!s} is not allowed to "
                           "impersonate via JWT.".format(wrong_username)))
     if required_role and r.get("role") not in required_role:

{edumfa-2.7.2 → edumfa-2.8.0}/edumfa/api/token.py

@@ -41,7 +41,7 @@ from ..lib.token import (init_token, get_tokens_paginate, assign_token,
                          reset_token, resync_token, set_pin_so, set_pin_user,
                          set_pin, set_description, set_count_window,
                          set_sync_window, set_count_auth,
-                         set_hashlib, set_max_failcount, set_realms,
+                         set_hashlib, set_max_failcount, set_realms, set_use_timeshift,
                          copy_token_user, copy_token_pin, lost_token,
                          get_serial_by_otp, get_tokens,
                          set_validity_period_end, set_validity_period_start, add_tokeninfo,
@@ -795,6 +795,7 @@ def set_api(serial=None):
         * max_failcount
         * validity_period_start
         * validity_period_end
+        * use_timeshift
 
     The token is identified by the unique serial number or by the token owner.
     In the later case all tokens of the owner will be modified.
@@ -822,6 +823,7 @@ def set_api(serial=None):
     count_auth_success_max = getParam(request.all_data, "count_auth_success_max")
     validity_period_start = getParam(request.all_data, "validity_period_start")
     validity_period_end = getParam(request.all_data, "validity_period_end")
+    use_timeshift = getParam(request.all_data, "use_timeshift")
 
     res = 0
 
@@ -874,6 +876,11 @@ def set_api(serial=None):
                                        validity_period_start)})
         res += set_validity_period_start(serial, user, validity_period_start)
 
+    if use_timeshift is not None:
+        g.audit_object.add_to_log({'action_detail': "use_timeshift=%r, "
+                                                    "" % use_timeshift})
+        set_use_timeshift(serial, use_timeshift)
+
     g.audit_object.log({"success": True})
     return send_result(res)
 

{edumfa-2.7.2 → edumfa-2.8.0}/edumfa/api/validate.py

@@ -389,6 +389,9 @@ def check():
         g.audit_object.log({"info": log_used_user(user, details.get("message")),
                             "success": success,
                             "serial": serials,
+                            "user": user.login,
+                            "resolver": user.resolver,
+                            "realm": user.realm,
                             "token_type": details.get("type")})
         return send_result(result, rid=2, details=details)
 

{edumfa-2.7.2 → edumfa-2.8.0}/edumfa/lib/auditmodules/sqlaudit.py

@@ -301,6 +301,15 @@ class Audit(AuditBase):
                 duration = datetime.datetime.now() - self.audit_data.get("startdate")
             else:
                 duration = None
+            # We wan't to reduce the passkey events a bit...
+            if self.config.get("EDUMFA_REDUCE_SQLAUDIT") == "1" or str(self.config.get("EDUMFA_REDUCE_SQLAUDIT")).lower() == "true":                
+                if (self.audit_data.get("action") == "POST /validate/triggerchallenge" or \
+                    "PRE-EVENT" in self.audit_data.get("action") or \
+                    "POST-EVENT" in self.audit_data.get("action")) and \
+                    self.audit_data.get("serial") == None and self.audit_data.get("user") == None:
+                    self.session.close()                    
+                    self.audit_data = {}
+                    return
             le = LogEntry(action=self.audit_data.get("action"),
                           success=int(self.audit_data.get("success", 0)),
                           serial=self.audit_data.get("serial"),

{edumfa-2.7.2 → edumfa-2.8.0}/edumfa/lib/crypto.py

@@ -93,8 +93,7 @@ class SecretObj:
         self.preserve = preserve
 
     def getKey(self):
-        log.info('Requesting secret key '
-                 '- verify the usage scope and zero + free ')
+        log.debug('Requesting secret key - verify the usage scope and zero + free ')
         return decrypt(self.val, self.iv)
 
     def getPin(self):

{edumfa-2.7.2 → edumfa-2.8.0}/edumfa/lib/token.py

@@ -1113,6 +1113,10 @@ def init_token(param, user=None, tokenrealms=None,
     if validity_period_start:
         tokenobject.set_validity_period_start(validity_period_start)
 
+    use_timeshift = param.get("useTimeShift")
+    if use_timeshift is not None and use_timeshift != "default":
+        tokenobject.add_tokeninfo("useTimeShift", use_timeshift)
+
     # Safe the token object to make sure all changes are persisted in the db
     tokenobject.save()
     return tokenobject
@@ -2609,3 +2613,23 @@ def list_tokengroups(tokengroup=None):
         tgs = TokenTokengroup.query.all()
 
     return tgs
+
+@log_with(log)
+def set_use_timeshift(serial, use_timeshift=""):
+    """
+    Set the value for use_timeshift in the tokeninfo.
+    Can be "True" or "False"
+
+    :param serial: The serial number of the token (exact)
+    :type serial: basestring
+    :param use_timeshift: True or False to override Token Config and enable/disable timeshift feature
+    :type use_timeshift: basestring
+    :return: None
+    """
+
+    tokenobject = get_one_token(serial=serial)
+    if use_timeshift == "default":
+        tokenobject.del_tokeninfo("useTimeShift")
+    else:
+        tokenobject.add_tokeninfo("useTimeShift", use_timeshift)
+    tokenobject.save()

{edumfa-2.7.2 → edumfa-2.8.0}/edumfa/lib/tokens/totptoken.py

@@ -199,14 +199,19 @@ class TotpTokenClass(HotpTokenClass):
         timeStep = param.get("timeStep", self.timestep)
         timeWindow = param.get("timeWindow", self.timewindow)
         timeShift = param.get("timeShift", self.timeshift)
+        if not timeShift:
+            timeShift = 0
         # we support various hashlib methods, but only on create
         # which is effectively set in the update
         hashlibStr = param.get("hashlib", self.hashlib)
+        useTimeShift = param.get("useTimeShift", "default")
 
         self.add_tokeninfo("timeWindow", timeWindow)
         self.add_tokeninfo("timeShift", timeShift)
         self.add_tokeninfo("timeStep", timeStep)
         self.add_tokeninfo("hashlib", hashlibStr)
+        if useTimeShift != "default":
+            self.add_tokeninfo("useTimeShift", useTimeShift)
 
     @property
     def timestep(self):
@@ -231,6 +236,16 @@ class TotpTokenClass(HotpTokenClass):
         shift = float(self.get_tokeninfo("timeShift") or 0)
         return shift
 
+    @property
+    def is_timeshift_enabled(self):
+        useShift = self.get_tokeninfo("useTimeShift")
+        if useShift is None:
+            useShift = get_from_config("totp.useTimeShift", default=True, return_bool=True)
+        if useShift in ["True", "true", "1", 1, True]:
+            return True
+        else:
+            return False
+
     @log_with(log)
     def check_otp_exist(self, otp, window=None, options=None, symetric=True,
                         inc_counter=True):
@@ -321,7 +336,9 @@ class TotpTokenClass(HotpTokenClass):
         if initTime != -1:
             server_time = int(initTime)
         else:
-            server_time = time.time() + self.timeshift
+            server_time = time.time()
+            if self.is_timeshift_enabled:
+                server_time += self.timeshift
 
         # If we have a counter from the parameter list
         if not counter:
@@ -356,22 +373,25 @@ class TotpTokenClass(HotpTokenClass):
 
             # here we calculate the new drift/shift between the server time
             # and the tokentime
-            tokentime = self._counter2time(res, self.timestep)
-            tokenDt = datetime.datetime.fromtimestamp(tokentime / 1.0)
+            if self.is_timeshift_enabled:
+                tokentime = self._counter2time(res, self.timestep)
+                tokenDt = datetime.datetime.fromtimestamp(tokentime / 1.0)
 
-            nowDt = datetime.datetime.fromtimestamp(inow / 1.0)
+                nowDt = datetime.datetime.fromtimestamp(inow / 1.0)
 
-            lastauth = self._counter2time(oCount, self.timestep)
-            lastauthDt = datetime.datetime.fromtimestamp(lastauth / 1.0)
+                lastauth = self._counter2time(oCount, self.timestep)
+                lastauthDt = datetime.datetime.fromtimestamp(lastauth / 1.0)
 
-            log.debug("last auth : {0!r}".format(lastauthDt))
-            log.debug("tokentime : {0!r}".format(tokenDt))
-            log.debug("now       : {0!r}".format(nowDt))
-            log.debug("delta     : {0!r}".format((tokentime - inow)))
+                log.debug("last auth : {0!r}".format(lastauthDt))
+                log.debug("tokentime : {0!r}".format(tokenDt))
+                log.debug("now       : {0!r}".format(nowDt))
+                log.debug("delta     : {0!r}".format((tokentime - inow)))
 
-            new_shift = (tokentime - inow)
-            log.debug("the counter {0!r} matched. New shift: {1!r}".format(res, new_shift))
-            self.add_tokeninfo('timeShift', new_shift)
+                new_shift = (tokentime - inow)
+                log.debug("the counter {0!r} matched. New shift: {1!r}".format(res, new_shift))
+                self.add_tokeninfo('timeShift', new_shift)
+            else:
+                log.debug("the counter {0!r} matched.".format(res))
         return res
 
     @log_with(log)
@@ -398,6 +418,9 @@ class TotpTokenClass(HotpTokenClass):
         if autosync is False:
             return res
 
+        if not self.is_timeshift_enabled:
+            return res
+
         info = self.get_tokeninfo()
         syncWindow = self.get_sync_window()
 
@@ -553,8 +576,10 @@ class TotpTokenClass(HotpTokenClass):
         if current_time:
             time_seconds = self._time2float(current_time)
 
+        if self.is_timeshift_enabled:
+            time_seconds += self.timeshift
         # we don't need to round here as we have already float
-        counter = self._time2counter(time_seconds + self.timeshift, self.timestep)
+        counter = self._time2counter(time_seconds, self.timestep)
         otpval = hmac2Otp.generate(counter=counter,
                                    inc_counter=False,
                                    do_truncation=do_truncation,
@@ -605,8 +630,10 @@ class TotpTokenClass(HotpTokenClass):
             # use the current server time
             tCounter = self._time2float(datetime.datetime.now())
 
+        if self.is_timeshift_enabled:
+            tCounter -= self.timeshift
         # we don't need to round here as we have alread float
-        counter = self._time2counter(tCounter - self.timeshift, self.timestep)
+        counter = self._time2counter(tCounter, self.timestep)
 
         otp_dict["shift"] = self.timeshift
         otp_dict["timeStepping"] = self.timeshift
@@ -616,7 +643,9 @@ class TotpTokenClass(HotpTokenClass):
             for i in range(0, count):
                 otpval = hmac2Otp.generate(counter=counter + i,
                                            inc_counter=False)
-                timeCounter = ((counter + i) * self.timestep) + self.timeshift
+                timeCounter = (counter + i) * self.timestep
+                if self.is_timeshift_enabled:
+                    timeCounter += self.timeshift
 
                 val_time = datetime.datetime.\
                     fromtimestamp(timeCounter).strftime("%Y-%m-%d %H:%M:%S")
@@ -630,6 +659,7 @@ class TotpTokenClass(HotpTokenClass):
     def get_setting_type(key):
         settings = {"totp.hashlib": "public",
                     "totp.timeStep": "public",
+                    "totp.useTimeShift": "public",
                     "totp.timeWindow": "public"}
         return settings.get(key, "")
 

{edumfa-2.7.2 → edumfa-2.8.0}/edumfa/lib/tokens/webauthn.py

@@ -93,7 +93,7 @@ DEFAULT_CLIENT_EXTENSIONS = {'appid': None, 'credProps': {'rk': None}, 'prf': No
 
 # Default authenticator extensions
 #
-DEFAULT_AUTHENTICATOR_EXTENSIONS = {"credProtect": None}
+DEFAULT_AUTHENTICATOR_EXTENSIONS = {"credProtect": None, 'hmac-secret': None}
 
 log = logging.getLogger(__name__)
 
@@ -295,6 +295,7 @@ class TRANSPORT:
     BLE = 'ble'
     NFC = 'nfc'
     INTERNAL = 'internal'
+    HYBRID = 'hybrid'
 
 
 TRANSPORTS = (
@@ -302,6 +303,7 @@ TRANSPORTS = (
     TRANSPORT.BLE,
     TRANSPORT.NFC,
     TRANSPORT.INTERNAL,
+    TRANSPORT.HYBRID
 )
 
 class RESIDENT_KEY_LEVEL:

{edumfa-2.7.2 → edumfa-2.8.0}/edumfa/lib/tokens/webauthntoken.py

@@ -467,7 +467,7 @@ IMAGES = IMAGES
 DEFAULT_DESCRIPTION = _('Generic WebAuthn Token')
 
 # Policy defaults
-DEFAULT_ALLOWED_TRANSPORTS = "usb ble nfc internal"
+DEFAULT_ALLOWED_TRANSPORTS = "usb ble nfc internal hybrid"
 DEFAULT_TIMEOUT = 60
 DEFAULT_USER_VERIFICATION_REQUIREMENT = 'preferred'
 DEFAULT_AUTHENTICATOR_ATTACHMENT = 'either'
@@ -629,7 +629,7 @@ class WebAuthnTokenClass(TokenClass):
                     WEBAUTHNACTION.ALLOWED_TRANSPORTS: {
                         'type': 'str',
                         'desc': _("A list of transports to prefer to communicate with WebAuthn tokens. "
-                                  "Default: usb ble nfc internal (All standard transports)"),
+                                  "Default: usb ble nfc internal hybrid (All standard transports)"),
                         'group': WEBAUTHNGROUP.WEBAUTHN
                     },
                     WEBAUTHNACTION.TIMEOUT: {